Comment by devilsdata
Comment by devilsdata 9 days ago
Email magic links are inconvenient for the user, but they're not dumb. They're a pretty good option for a small project by a developer doesn't want to implement a whole auth flow, or pay for an OAuth provider.
It's a tradeoff. If you roll your own password flow, you need to add MFA to be secure. The complexity of what you need to build and maintain goes up.
A simple magic link flow for an app like this, where you are really only likely to log into it once per project you start.
Personally though, I also use a password manager. And I am annoyed enough by email magic links, that any of my personal projects will at least have a passkey implementation.
So I agree they're annoying. But they're definitely not "dumb". They're a tradeoff. This developer has chosen his own time over user convenience; which is a common tradeoff for small developers.
The problem with magic links is that the secret is sent with each login attempt. It's just like SMS verification codes - an attacker that controls the email address, or the phone number, can log right in. In this case, probably without even resetting a password. Plus, with no way to verify the account owner other than the email address, if the email address is lost or changed, the account's as good as gone.
Also yes they're super annoying for the user too. It's inconvenient and less secure.
Passkeys are awesome, yeah.